emotet | 5c4d9d71040604f2a6cd8fa3e69a3af1f79590348729cd0d90abbb8ea51a05a9

Analysis

Target
3102132775b47d2ff1c40a2b5293ba60.dll
Size 416KB
Sample211124-s7ns2sdagj
SHA256 5c4d9d71040604f2a6cd8fa3e69a3af1f79590348729cd0d90abbb8ea51a05a9
MD5 3102132775b47d2ff1c40a2b5293ba60
SHA1 8d54c54e8eff10bf087236af120367620b61a622
SHA512 ca05549daa48c7de1c5cb1daf2eb041f5807bc0376fa6f79b94f65e93eaf3d00d53119689e9b22dce0eae6e3fc12f2b9cd58de29d827927f343bdcbb385b6d59
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 6 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4436	rundll32.exe
4436	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3160	3472	rundll32.exe	68
PID 3472 wrote to memory of 3160	3472	rundll32.exe	68
PID 3472 wrote to memory of 3160	3472	rundll32.exe	68
PID 3160 wrote to memory of 1856	3160	rundll32.exe	69
PID 3160 wrote to memory of 1856	3160	rundll32.exe	69
PID 3160 wrote to memory of 1856	3160	rundll32.exe	69
PID 1856 wrote to memory of 4076	1856	rundll32.exe	70
PID 1856 wrote to memory of 4076	1856	rundll32.exe	70
PID 1856 wrote to memory of 4076	1856	rundll32.exe	70
PID 4076 wrote to memory of 4436	4076	rundll32.exe	71
PID 4076 wrote to memory of 4436	4076	rundll32.exe	71
PID 4076 wrote to memory of 4436	4076	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3102132775b47d2ff1c40a2b5293ba60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3102132775b47d2ff1c40a2b5293ba60.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3102132775b47d2ff1c40a2b5293ba60.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3102132775b47d2ff1c40a2b5293ba60.dll",Control_RunDLL
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3102132775b47d2ff1c40a2b5293ba60.dll",Control_RunDLL
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        
        PID:4436

memory/1856-120-0x0000000010001000-0x0000000010024000-memory.dmp

Download